{
    admin off
}

{{ services.emby.domain }} {
    tls {{ secrets.tls_email }}

    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        -Server
    }

    reverse_proxy emby:8096
}

{{ services.ipfs.domain }} {
    tls {{ secrets.tls_email }} {
        dns njalla {{ secrets.caddy.njalla_api_token }}
    }

    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        -Server
    }

    @local {
        remote_ip {{ local_ipv4s | join(' ') }}
    }

    handle @local {
        reverse_proxy ipfs_kubo:5001
    }

    respond 403
}

{{ services.ipfs.gateway_domain }},
*.ipfs.{{ services.ipfs.gateway_domain }},
*.ipns.{{ services.ipfs.gateway_domain }} {
    tls {{ secrets.tls_email }} {
        dns njalla {{ secrets.caddy.njalla_api_token }}
    }

    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        -Server
    }

    reverse_proxy ipfs_kubo:8080
}

{{ services.monerod.domain }}:18089 {
    tls {{ secrets.tls_email }}

    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        -Server
    }

    reverse_proxy monerod:18089
}

{{ services.nextcloud.domain }} {
    tls {{ secrets.tls_email }}

    rewrite /.well-known/caldav /remote.php/dav
    rewrite /.well-known/carddav /remote.php/dav

    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        -Server
    }

    reverse_proxy nextcloud:80
}

{{ services.pihole.domain }} {
    tls {{ secrets.tls_email }} {
        dns njalla {{ secrets.caddy.njalla_api_token }}
    }

    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        -Server
    }

    @local {
        remote_ip {{ local_ipv4s | join(' ') }}
    }

    handle @local {
        reverse_proxy pihole:80
    }

    respond 403
}